CVE-2026-111096: JetBrains TeamCity Stored XSS Vulnerability

CVE-2026-111096 Overview

CVE-2026-111096 is a stored Cross-Site Scripting (XSS) vulnerability affecting JetBrains TeamCity continuous integration server. The flaw resides in the classic build log component, where attacker-controlled content is rendered without proper output encoding. An authenticated user with permission to trigger builds can inject malicious script content into the build log. When another user views the affected log, the script executes in their browser session under the TeamCity origin.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, build pipeline tampering, and lateral access to CI/CD secrets.

Affected Products

JetBrains TeamCity versions prior to 2026.2
JetBrains TeamCity versions prior to 2026.1.4
JetBrains TeamCity versions prior to 2025.11.8

Discovery Timeline

2026-10-15 - CVE-2026-111096 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-111096

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. The classic build log view in TeamCity renders text content captured during build execution. The affected rendering path fails to sanitize or encode HTML control characters before writing them into the response document.

Because the log data is persisted on the server, the malicious payload fires every time any authenticated user opens the affected build. This produces a persistent attack surface tied to CI pipelines rather than a transient reflected injection. The scope-changed vector in the attack metrics indicates that script execution can reach resources beyond the vulnerable component itself, including administrative interfaces reachable from the same origin.

Root Cause

The root cause is missing output encoding when the classic build log viewer emits log lines into the DOM. Build output can contain arbitrary characters produced by compilers, test runners, or custom build steps. When those characters include HTML tags or <script> fragments, the renderer treats them as markup instead of literal text.

Attack Vector

Exploitation requires an authenticated user with build-triggering permissions and user interaction from a victim who later views the log. A typical attack sequence involves committing a build step or test case that writes a crafted payload such as <img src=x onerror=...> to standard output. The payload is persisted into the build log store. When a reviewer, administrator, or project lead opens the classic build log, the browser parses and executes the injected markup.

Successful exploitation can be used to exfiltrate TeamCity session cookies, forge requests to the TeamCity REST API using the victim's privileges, or modify project configurations, VCS roots, and build parameters that contain credentials.

Detection Methods for CVE-2026-111096

Indicators of Compromise

Build log entries containing HTML tags such as <script>, <img onerror=>, or <svg onload=> written by build steps that would not normally emit markup.
Unexpected outbound HTTP requests from reviewer browsers to attacker-controlled domains shortly after opening a TeamCity build log.
New or modified TeamCity administrator accounts, API tokens, or VCS roots created through authenticated sessions following log review activity.

Detection Strategies

Review persisted build logs for HTML or JavaScript syntax using static scans across the TeamCity data directory.
Correlate TeamCity audit log entries with web proxy logs to identify suspicious cross-origin requests originating from /viewLog.html sessions.
Monitor for configuration changes made immediately after a user opens a build triggered by an unusual or external contributor.

Monitoring Recommendations

Enable TeamCity audit logging and forward events to a centralized logging platform for retention and correlation.
Alert on creation of new administrator-scoped API tokens and on modifications to build configurations containing secrets.
Track browser-side Content Security Policy (CSP) violation reports if CSP is enforced in front of TeamCity.

How to Mitigate CVE-2026-111096

Immediate Actions Required

Upgrade TeamCity to version 2026.2, 2026.1.4, or 2025.11.8 or later, matching your current release branch.
Rotate TeamCity session tokens, API keys, and any credentials stored in build parameters that may have been exposed during the vulnerable window.
Audit recent build logs and configuration changes performed by accounts with build-triggering privileges.

Patch Information

JetBrains addressed the issue in TeamCity 2026.2, 2026.1.4, and 2025.11.8. Refer to the JetBrains Security Issues Fixed page for the complete advisory and release notes.

Workarounds

Restrict build-triggering and project-editing permissions to trusted users until the patched version is deployed.
Require reviewers to use the experimental build log viewer instead of the classic view where feasible.
Place TeamCity behind a reverse proxy that enforces a restrictive Content Security Policy to reduce the impact of script execution.

bash

# Verify installed TeamCity version after upgrade
curl -s https://teamcity.example.com/app/rest/server \
  -H "Authorization: Bearer $TC_TOKEN" | grep -i version